krakenjs / lusca

Application security for express apps.
Other
1.79k stars 139 forks source link

lusca.xframe value - "ALLOW-FROM uri" is obselete #141

Open kruthivijay31 opened 3 years ago

kruthivijay31 commented 3 years ago

Hello Team,

Based on the README, it's recommended to use ALLOW-FROM URI but MDN docs recommend not to use it as its obsolete and is not supported in a modern browser.

Recommended alternative https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors.